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REMARKS 

The Examiner rejected Claims 1. 3-7, 13. 15-19, 25. and 27-31 under 35 U.S.C. 103(a) as 
being unpatentable over U.S. Patent 5.278.901 to Shieh et al. (Shieh). in view of U.S. Patent No. 
5.440,723 to Arnold et al. (Arnold), and further in view of U.S. Patent No. 5,832,208 to Chen et al. 
(Chen). Applicant respectfully disagrees with such rejection. 

Specifically, in the Examiner's latest response to applicant's previous arguments, the 
Examiner relies on the foUowing teaching of Shieh (in combination with Chen) to make a prior art 
showing of applicant's claimed "wherein one of said measurement parameters is how many e-ma,l 
messages are sent having an identical message title" (see all pending independent cla,ms). 

30) 

With respect to Chen, the Examiner relies on the following excerpt (in combination with the 
foregoing Shieh excerpt) to make a prior art showing of the foregoing claim limitations: 

»Of particular concern in relation to the transaiission of computer viruses 
ifelectronic mail (e-mail) . There is a growxng --^^^,%-^^\^°„,rk) and 
communicate within an internet with computer users 

may contain a *^^?,,;"^^^^^''t""internet may contain aB an attachment a 
tnail message received ^^f^.'^^^ J"^f^"^^ Macro virus; an e-mail message 

lines 17-32) 
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The Examiner continues by arguing that "because Chen teaches the danger of email 

attachments in association with viruses it would have been obvious to one having ordinary skill 

in the art to monitor all characteristics of a broadcast email. Specifically these threshold parameters 
would include email subject line, since a broadcast email would have the same subject line." 

Applicant respectfully disagrees with this assertion. First, Chen's focus on the danger of 
attachments teaches a^ay from any sort of - how many e-mail me^^^.p. .re sent havin. an identical 
message title ." as claimed by applicant. Specifically, the review of attachments would, in no way, 
involve analysis of e^mailm^sagetifles. let alone " how many e-mail m essa pes are sent having an 
y^rticaLmessagetitk." By specifically addressing only attachments and not e-mail messages 
themselves (i.e. e-mail message titles, etc.). Chen teaches away from applicant's claimed invention. 
Only applicant teaches and claims the specific analysis of the number of e-mail messages that are 
sent having an identical message title for the specific purpose of detecting virus-related behavior. 
independent of attachments, etc. 

The Examiner argues that the proposed combination, when broadly interpreted, meets 
applicant's claim limitations, and asserts that no Official Notice is invoked. In reviewing the 
Examiner's proposed combination, however, there is not even a suggestion of monitoring e^naU 
message titles, let alone "V,»w n.«nv e-mail messages are sent havinp an identical message title ." 
From the Examiner's argument that the "threshold parameters would include email subject line, 
since a broadcast email would have the same subject line." applicant is left to assume that the 
Examiner is relying on an inherency argument (since the Examiner is relying on subject matter not in 
the explicit teachings of the combined references). 

In view of the foregoing arguments made hereinabove, any such inherency argument has been 
adequately rebutted, and a notice of allowance or a specific prior art showing of such claim features, 
in combination with the remaining claim elements is respectfully requested. (See MPEP 21 12) 

AppUcant further notes that the Examiner has not even fully considered and/or responded to 
applicant's previous arguments. Specifically, the Examiner has relied on the following excerpt from 
Shieh to meet applicant's claimed measuring "one or more measurement parameters indicative of 
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nonvin. specific ac««.yof .aid comp»,=r3ppara««ov«ar«pecHv.n,eas^ment^^^^^^^ 
Ipartag -said one o. .ore n,e.— paran,e.e. wi.H ^ecttve prede,enn,ned «.e*o.d 
levels." 



.The indirect-write Pa^^ern of vxrus propaga.x«« .^^.^^^.^ 
appear individually or «^»^l^*^^°^^i^^i°g c^ditions: (a) |v.. set (out 
til present inventxon usxng the ^ °"°*'J^|tioii of elements are executable 
iw/lw*. virus) >threshold and a J-^.^^^e por" set in, 

fi(L; (2) IC. -V-^^ ^tr^'shold S Stai, cWcbVlcb/Icb*, 

cb/cb*/lcb/lcb*. virus)|>ttaeshold, ^ |C 

virus)|>threshold; (5) V. set{out parameters defining 

set(out, Id/Id*, virus) l>threshold^ TM u occurrences of a 

Jiftrm^^x^eedrthl Sr^fS^id^rabn'o-ality occurs." Ccol. X7. X.nes X7- 

30> 

such excerpt along with the remaining Shieh reference, however, fails to disclose, teach or 
even suggest applicant's claimed "one or more measurement parameters indicative of i™ 
...eifioctivit, of said computer apparatus o^^nr n r. n^.ctive measnrement period (emphasis 
added). 

Specifically, each of the conditions mentioned in the above excerpt are a function of a 
•Virus," and thus do not meet applicant's claimed specific measurement parameters that are 

indicative cn.Hfic activity. Only applicant teaches and claims such a threshold-based 

detection method that is based on non^dmsEecifi^^ as specifically claimed. 



Virus 



Further the conditions outlined in the Shieh reference make absolutely no mention of any 
tin^e dependence. Thus, Shieh fails to meet applicant's claimed measurement of the related 

parameters r, n r-T"-- — — ™^ ^ ^^^"^^ " " " 

evidenced by the foregoing excerpt 

Applicant respectfully asserts that aUgasUhe third element of the p nn.a facie case of 

♦ K..n .,.^t MHce the orior art references, when combined, fail to teach or suggest 
nhviousnes g has tint been met, smce ine pnor <» 

all the claim limitations 
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,.p«.4e„. claims. J„,.bywayof«^l..^p1i-1ca„"0.f,„d=.yexp,icitsugses..o»oftt,e 
following dataed subject maner, in «h= Examiner's proposed coobmanon: 

■Vherein one of said measurement panonete,. is how many e-mail messages are sen, having 
an identical file attachment" (see Claim 3 et al.); 

.S.her=in one of said measurement parameters is how many e-mail messages are sent having 
a Ble attachment of a given file type" (see Claim 4 et al.); 

•■whetein one of said measurement parameters is e-mail throughput Within said computer 
system" (see Claim 6 et al.); and 

.^vherein each e-maU processed has an associated size value and e-mail throughput is 
measured in a form dependent upon anumber of e-mails multipHedby a total of size values 
for said e-mails" (see Claim 7 et al.)- 

Since the Examiner is relying on teachings that are no. expUeitly sc. forth m the proposed 
combination, applicant assumes that .ho Examine is agdn relying on an Merency argmnen.. The 
fo,egoingfeannes.however.providepar.icularadvanttgeoverfl,eExaminer-sproposed ^ 
combination, by reviewingspecificrypes of ac.ivi.y(*a.areno.evensug^s«dbyfl,eExammers 

combination) which may possibly be initiated by a vims. 

Again, in view of Ute foregoing argument made hereinabove, any such inherency argumen. 
has been ade,ua.ely rebutted, and a notice of allowance or a specific prior art sho^g of such cUm, 
features, in combination with the remaining claim elements is respectfully requested. (See MPEP 
2112) 

A notice of allowance is respectfully requested. 
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to to event a telephone conversation would expedite the prosecution of this applicafon. the 
Examiner may reach the undesigned at (408) 505-5.00. The Commissioner is audtonzed to charge 
any additional fees or credit any overpayment to Deposit Account No. 50-1 351 (Order No. 
NAI1P154). 



P.O. Box 721120 

San Jose. CA 95172-1 120 

408-505-5100 



Kevin 
Regisi 




41,429 
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